CVE-1999-0668: Medium severity Microsoft Internet Explorer vulnerability
The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
scriptlet.typelib ActiveX controlfrom your environment.Unregister or remove the scriptlet.typelib ActiveX control from affected systems (for example, unregister the control) so it cannot be invoked by web content.
- Configuration
Reconfigure Internet Explorer security settings (or use Group Policy) to prevent the scriptlet.typelib ActiveX control from being usable by web content — disable scripting of this control or disable ActiveX scripting for Internet and untrusted security zones.
Internet Explorer ActiveX / Active Scripting for web content = disable scriptlet.typelib or disable ActiveX scripting for untrusted/internet zones - Compensating control
Apply network-level mitigations: block or filter ActiveX/Active Scripting content at the perimeter (proxy/WAF) and restrict access to sites that may host exploit pages; enforce IE security zones to allow ActiveX only from trusted sites.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0668?
CVE-1999-0668 has a high severity rating due to its ability to allow remote attackers to execute arbitrary commands.
How do I fix CVE-1999-0668?
To fix CVE-1999-0668, update to a later version of Internet Explorer that does not include the vulnerable ActiveX control.
Which versions of Internet Explorer are affected by CVE-1999-0668?
CVE-1999-0668 affects Internet Explorer versions 4.0 and 5.0.
What is the impact of CVE-1999-0668?
The impact of CVE-1999-0668 allows attackers to execute unwanted commands on a user's system remotely.
Is there a workaround for CVE-1999-0668?
A temporary workaround for CVE-1999-0668 includes disabling ActiveX controls within Internet Explorer settings.